Incorrect URL/%TOKEN% for forgotten password

[aaovchinnikov]

In version 2.0.5 I face security violation error when I follow the link in Forgotten Password e-mail.
Link is created with default pattern @SiteURL@/public/forgottenpassword/%TOKEN%

In logs I can see that %TOKEN% part of URL fails validation

2023-02-15T12:27:18Z, WARN , util.Validator, stripped potentially harmful chars from value: input=https://<SiteURL>/pwm/public/forgottenpassword/<TOKEN> strippedOutput=https://<SiteURL>/pwm/public/forgottenpassword/....
2023-02-15T12:27:18Z, WARN , http.PwmHttpResponseWrapper, attempt to write cookie 'SESSION' after response is committed
2023-02-15T12:27:18Z, WARN , http.PwmHttpResponseWrapper, attempt to write cookie 'ID' after response is committed2023-02-15T12:27:18Z, ERROR, http.PwmResponse, {txMup} 5063 ERROR_SECURITY_VIOLATION (request URL path segment contains illegal characters) 
2023-02-15T12:27:18Z, ERROR, filter.RequestInitializationFilter, {txMup} 5063 ERROR_SECURITY_VIOLATION (request URL path segment contains illegal characters)

As I can see, in logs %TOKEN% value in URL contains %0D (carriage return) symbols, that leads to failed validation.

If I copy/paste %TOKEN% from e-mail to forgotten password field everything works fine.
Version 2.0.4 works fine.

To Reproduce

1. Deploy and use PWM v2.0.5
2. Use button "Forgotten password"
3. Specify correct e-mail for user to send restoration token
4. Press link in e-mail
5. Get PWM security violation error

[blissjoe]

I'm also seeing this issue after upgrading from v2.0.4 to v2.0.5

This is the URL sent with 2.0.4 -
https://url/pwm/public/forgottenpassword?processAction=enterCode&token=TOKEN

This is the URL sent with 2.0.5 -
https://url/pwm/public/forgottenpassword/TOKEN

If I add the missing processAction then the URL doesn't throw the security violation error.

[jrivard]

fix in commit 77f5669

[jrivard]

As a workaround you can set the following in Settings ⇨ Application ⇨ App Property Overrides:

security.http.permittedUrlPathCharacters=^[a-zA-Z0-9-_]*$

[blissjoe]

Thanks for the information! I had to also add an = sign to my override.

Edit - I deleted my older comment from another account and re-posted.

[jrivard]

Fixed in 2.0.6 release.